linux-kernel - Re: [PATCH] drm/amd/display: fix array-bounds error in dc_stream_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4b21a150-a567-dafa-1a55-8496cdb0cec6@amd.com>
Date:   Thu, 29 Sep 2022 11:41:58 -0400
From:   Hamza Mahfooz <hamza.mahfooz@....com>
To:     Felix Kuehling <felix.kuehling@....com>,
        "Pillai, Aurabindo" <Aurabindo.Pillai@....com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc:     "Wang, Chao-kai (Stylon)" <Stylon.Wang@....com>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "Li, Sun peng (Leo)" <Sunpeng.Li@....com>,
        Po-Yu Hsieh Paul <Paul.Hsieh@....com>,
        "Pan, Xinhui" <Xinhui.Pan@....com>,
        "Siqueira, Rodrigo" <Rodrigo.Siqueira@....com>,
        "amd-gfx@...ts.freedesktop.org" <amd-gfx@...ts.freedesktop.org>,
        David Airlie <airlied@...ux.ie>,
        "Hung, Alex" <Alex.Hung@....com>,
        "Lee, Alvin" <Alvin.Lee2@....com>,
        "Deucher, Alexander" <Alexander.Deucher@....com>,
        "Wu, Hersen" <hersenxs.wu@....com>,
        "Ma, Leo" <Hanghong.Ma@....com>,
        Jimmy Kizito <Jimmy.Kizito@....com>,
        "Koenig, Christian" <Christian.Koenig@....com>,
        "Kotarac, Pavle" <Pavle.Kotarac@....com>
Subject: Re: [PATCH] drm/amd/display: fix array-bounds error in
 dc_stream_remove_writeback()



On 2022-09-29 11:36, Felix Kuehling wrote:
> I'm still seeing a warning even with this fix:
> 
> /home/fkuehlin/compute/kernel/drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ?dc_stream_remove_writeback?:
> /home/fkuehlin/compute/kernel/drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: warning: array subscript 1 is above array bounds of ?struct dc_writeback_info[1]? [-Warray-bounds]
>    527 |     stream->writeback_info[j] = stream->writeback_info[i];
>        |                                 ~~~~~~~~~~~~~~~~~~~~~~^~~
> 

What version of GCC are you using? I don't see it on GCC 12.2 with this 
patch applied.

> Regards,
>    Felix
> 
> 
> Am 2022-09-27 um 16:35 schrieb Pillai, Aurabindo:
>>
>> [AMD Official Use Only - General]
>>
>>
>> [AMD Official Use Only - General]
>>
>>
>> Reviewed-by: Aurabindo Pillai <aurabindo.pillai@....com>
>>
>> -- 
>>
>> Regards,
>> Jay
>> ------------------------------------------------------------------------
>> *From:* Mahfooz, Hamza <Hamza.Mahfooz@....com>
>> *Sent:* Tuesday, September 27, 2022 3:12 PM
>> *To:* linux-kernel@...r.kernel.org <linux-kernel@...r.kernel.org>
>> *Cc:* Mahfooz, Hamza <Hamza.Mahfooz@....com>; Wentland, Harry 
>> <Harry.Wentland@....com>; Li, Sun peng (Leo) <Sunpeng.Li@....com>; 
>> Siqueira, Rodrigo <Rodrigo.Siqueira@....com>; Deucher, Alexander 
>> <Alexander.Deucher@....com>; Koenig, Christian 
>> <Christian.Koenig@....com>; Pan, Xinhui <Xinhui.Pan@....com>; David 
>> Airlie <airlied@...ux.ie>; Daniel Vetter <daniel@...ll.ch>; Lee, Alvin 
>> <Alvin.Lee2@....com>; Hung, Alex <Alex.Hung@....com>; Kotarac, Pavle 
>> <Pavle.Kotarac@....com>; Wang, Chao-kai (Stylon) 
>> <Stylon.Wang@....com>; Pillai, Aurabindo <Aurabindo.Pillai@....com>; 
>> Ma, Leo <Hanghong.Ma@....com>; Wu, Hersen <hersenxs.wu@....com>; Po-Yu 
>> Hsieh Paul <Paul.Hsieh@....com>; Jimmy Kizito <Jimmy.Kizito@....com>; 
>> amd-gfx@...ts.freedesktop.org <amd-gfx@...ts.freedesktop.org>; 
>> dri-devel@...ts.freedesktop.org <dri-devel@...ts.freedesktop.org>
>> *Subject:* [PATCH] drm/amd/display: fix array-bounds error in 
>> dc_stream_remove_writeback()
>> Address the following error:
>> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function 
>> ‘dc_stream_remove_writeback’:
>> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: 
>> error: array subscript [0, 0] is outside array bounds of ‘struct 
>> dc_writeback_info[1]’ [-Werror=array-bounds]
>>   527 | stream->writeback_info[j] = stream->writeback_info[i];
>>       | ~~~~~~~~~~~~~~~~~~~~~~^~~
>> In file included from 
>> ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc.h:1269,
>>                  from 
>> ./drivers/gpu/drm/amd/amdgpu/../display/dc/inc/core_types.h:29,
>>                  from 
>> ./drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dc_common.h:29,
>>                  from 
>> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:27:
>> ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc_stream.h:241:34: note: 
>> while referencing ‘writeback_info’
>>   241 |         struct dc_writeback_info writeback_info[MAX_DWB_PIPES];
>>       |
>>
>> Currently, we aren't checking to see if j remains within
>> writeback_info[]'s bounds. So, add a check to make sure that we aren't
>> overflowing the buffer.
>>
>> Signed-off-by: Hamza Mahfooz <hamza.mahfooz@....com>
>> ---
>>  drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
>> b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
>> index 3ca1592ce7ac..ae13887756bf 100644
>> --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
>> +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
>> @@ -520,7 +520,7 @@ bool dc_stream_remove_writeback(struct dc *dc,
>>          }
>>
>>          /* remove writeback info for disabled writeback pipes from 
>> stream */
>> -       for (i = 0, j = 0; i < stream->num_wb_info; i++) {
>> +       for (i = 0, j = 0; i < stream->num_wb_info && j < 
>> MAX_DWB_PIPES; i++) {
>>                  if (stream->writeback_info[i].wb_enabled) {
>>                          if (i != j)
>>                                  /* trim the array */
>> -- 
>> 2.37.2
>>

-- 
Hamza